Method for protecting data used in cloud computing with homomorphic encryption

ABSTRACT

A method for protection of cloud computing includes homomorphic encryption of data. Partially or fully homomorphic encryption allows for data within the cloud to be processed without decryption. A partially or fully homomorphic encryption is provided. The proposed scheme can be used with both an algebraic and analytical approaches. A cloud service is implemented on a server. A client encrypts data using fully homomorphic encryption and sends it to the server. The cloud server performs computations without decryption of the data and returns the encrypted calculation result to the client. The client decrypts the result, and the result coincides with the result of the same calculation performed on the initial plaintext data.

CROSS-REFERENCE TO RELATED APPLICATION

This application is a continuation of U.S. patent application Ser. No.13/667,167, filed on Nov. 2, 2012, which is a non-provisionalapplication of U.S. Provisional Pat. App. Ser. No. 61/556,507, filedNov. 7, 2011, which are incorporated by reference herein in theirentirety.

BACKGROUND OF THE INVENTION

1. Field of the Invention

This invention relates to data encryption methods, and moreparticularly, for protection of cloud system computations by homomorphicencryption.

2. Description of the Related Art

A conventional cloud is a computation resource that is provided to auser by a provider. All cloud services and infrastructure areimplemented by the provider and are hidden from the user. The clouds canbe divided into three classes:

Infrastructure as a Service—the provider implements functionality ofVirtual Machines (VMs) and controls the infrastructure of the VMs thatcan be created, modified or deleted by the client (user). A user candecide how to use the Service. An example of such system is Amazon WebServices.

Platform as a Service—the provider provides to a user a certain platformfor running applications. The provider is responsible for functionalityof the platform and the user only provides an application to be launchedon the platform. In this case, a cloud can be used for specialized tasksor types of tasks. An example of such system is Google App Engineplatform.

Software as a Service—the provider provides a complete application forperforming certain tasks. In this case, the provider is responsible forservicing the infrastructure, where the service runs, and for developingthe application that supports the service. Such cloud has specificnarrow specialization only for a particular task. An example of suchsystem is Gmail.

Only the first two classes allow for running user application (i.e.,logic) within the cloud. Protected cloud computing is a system whereoperations executed within the cloud cannot be determined from outside.Also, some data needs to be securely stored within the cloud for a longtime. Additionally, transferring data into the cloud needs to beprotected as well.

Thus, the protected cloud computing includes the following:

-   -   secure data storage within the cloud;    -   secure data processing within the cloud; and    -   secure data transfer in and out of the cloud.

Processing of data within the cloud is performed constantly. The clouddata often contains some critical personal data that can be accessedbased on the technical limitation of the cloud. So, the only way toprotect the data is to encrypt the files, so the perpetrator will not beable to read them.

Therefore, it is desired to have a system for protected cloud computing.Such system should have data in an encrypted form that cannot be read,even if the file is accessed. The data should be passed into the cloudalready in the encrypted form. The encryption needs to be performed atthe client site, so the cloud service does not know how the data isencrypted.

Also, the cloud should be able to process the encrypted data withoutdecrypting it. Otherwise, the cloud becomes little more than a securestorage. Each operation on data would require sending the data back tothe client for decryption and then sending the data back to the cloudfor processing. Alternatively, an encryption key can be sent to thecloud for data decryption. However, this would jeopardize the datawithin the cloud.

Conventional cloud services do not provide completely secure datastorage. In some rare cases the data can be encrypted on the clientsite. In other implementations the data is encrypted with the key thatis stored in the same cloud. Both cases are not secure and are notconvenient for efficient cloud computing. For example, personal orcorporate taxes are calculated by third party services. It is obviouslydesired to not disclose some income information to the third parties.The personal data needs to be encrypted and sent over for processing.Then the results are received and decrypted.

Therefore, there is a need in the art to process encrypted data withinthe cloud without decryption. Accordingly, a method for homomorphicencryption of the cloud data is desired, so the data can be processedwithout decryption.

SUMMARY OF THE INVENTION

Accordingly, the present invention is related to a system and method forprotection of cloud computing system by homomorphic encryption thatsubstantially obviates one or more of the disadvantages of the relatedart.

In one embodiment, system for protected cloud computing includes aserver receiving encrypted data from a client; the server performingfully homomorphic calculations for the client without decryption of theencrypted data and providing a result of the calculations to the clientfor decryption. A finite set of initial elements are generated on theclient and are fully homomorphically encrypted into a set of n encryptedelements, such that all calculations on unencrypted elements correspondto the same calculations on encrypted elements. The m encrypted elementsbelong to the finite set of the initial elements and each of the mencrypted elements has only one corresponding initial element. Theinitial elements are encrypted using an n-bit secret key z₀ that belongsto a Galois field G(2^(n)). For any initial element u of a Galois fieldG(2^(n)) there are n elements a₁, a₂, . . . , a_(d) of G(2^(n)) forwhich a₀=u−(a₁z₀+a₂(z₀)²+. . . +a_(d)(z₀)^(d)), and a polynomialv(z)=a₀+a₁z+a₂z²+. . . +a_(d)z^(d) from G(2^(n))[z] corresponds to uwith v(z₀)=u, with the coefficients a₁, a₂, . . . , a_(d) used as apublic encryption key. The encryption uses an encryption polynomialh(z)=u+(z−z₀)*r(z) where r(z) is an arbitrary polynomial fromG(2^(n))[z], and z₀ and u are fixed elements of G(2^(n)).

Fully homomorphic encryption allows for data within the cloud to beprocessed without decryption. Homomorphic encryption is a type ofencryption where operations on unencrypted data have correspondingoperations on encrypted data. If an operation O is performed on theencrypted data and then the data is decrypted, the result is the same asif the operation O has been performed on the unencrypted data

According to the exemplary embodiment, a special scheme for homomorphicencryption is provided. The proposed scheme can be used with bothalgebraic and analytical approaches. A cloud service is implemented on aserver. A client encrypts data and sends it to the server. The cloudserver performs computations without decryption of the data and returnsthe encrypted calculation result to the client. The client decrypts theresult and the result coincides with the result of the same calculationperformed on the plaintext data.

Additional features and advantages of the invention will be set forth inthe description that follows, and in part will be apparent from thedescription, or may be learned by practice of the invention. Theadvantages of the invention will be realized and attained by thestructure particularly pointed out in the written description and claimshereof as well as the appended drawings.

It is to be understood that both the foregoing general description andthe following detailed description are exemplary and explanatory and areintended to provide further explanation of the invention as claimed.

BRIEF DESCRIPTION OF THE ATTACHED FIGURES

The accompanying drawings, which are included to provide a furtherunderstanding of the invention and are incorporated in and constitute apart of this specification, illustrate embodiments of the invention and,together with the description, serve to explain the principles of theinvention.

In the drawings:

FIG. 1 illustrates a schematic of an exemplary computer system that canbe used for implementation of the invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

Reference will now be made in detail to the preferred embodiments of thepresent invention.

A method for homomorphic encryption of the cloud data is provided. Fullyhomomorphic encryption allows for data within the cloud to be processedwithout decryption. Fully homomorphic encryption schemes are malleable.A cryptosystem is malleable if it is possible to transform oneciphertext into another (in this case—math operations) without thedecryption.

A principle of homomorphism can be described as follows:

Let f:A→B where A and B are rings with addition, multiplication, andoptionally zero and one.

Then, f is homomorphism of the rings, if:

-   -   f(a+_(A)b)=f(a)+_(B)f(b)    -   f(a×_(A)b)=f(a)×_(B)f(b)    -   f(1_(A))=1_(B)    -   f(0_(A))=0_(B)

Homomorphism operations are secure (by definition), which is an inherentfeature of any homomorphic encryption. Homomorphic encryption is a typeof encryption where operations on unencrypted data have correspondingoperations on encrypted data. If an operation O is performed onencrypted data and then the data is decrypted, the result is the same asif the operation O has been performed on unencrypted data.

Accordingly, fully homomorphic encryption provides the above conditionfor all operations. Otherwise, the encryption is partially homomorphic.Fully homomorphic encryption satisfies all of the requirements forencryption of protected cloud services. In other words, fullyhomomorphic encryption allows for encryption of data and performingoperations on the encrypted data without decryption.

According to the exemplary embodiment, a special scheme for homomorphicencryption is provided. The proposed scheme can be used with both analgebraic and analytical approaches. The algebraic approach can bedescribed as follows. Formal polynomials create a ring A[x] relative toaddition and multiplication.

An example of homomorphism of the rings is as follows:

-   -   1. Transformation f(x)=x+c,f*: A[x]→ A[x]

A resulting (transformed) f* generated from f should be a homomorphismof the rings.

In case of formal polynomials (considered to have the same degree)

-   -   f*(ā_(m)+ b _(m))=f*((a₀+b₀, a₁+b₁, . . . , a_(m)+b_(m)))

The corresponding resulting polynomial is

-   -   R(x)=(a₀+b₀)+(a₁+b₁)x+. . . +(a_(m)+b_(m))x^(m)        while f(R(x))=(a₀+b₀)+(a₁+b₁)(x+c)+. . . . . .        +(a_(m)+b_(m))(x+c)^(m)

On the other hand, if P(x) and Q(x) correspond to formal polynomialā_((m)) and b _((m)), then

-   -   f(P(x))+f(Q(x))=a₀+a₁(x+c)+. . . . . .        +a_(m)(x+c)^(m)+b₀+b₁(x+c)+. . . +b_(m)(x+c)^(m)

Accordingly, f*(ā_((k))+ b _((m)))=f*(ā_((k)))+f*( b _((m)))

A product can be described in a similar manner:

-   -   P(x)·Q(x)=a₀b₀+(a₀b₁+a₁b₀)x+ +(a₀b₂+a₁b₁+a₂b₀)x²+. . .        +a_(m)b_(m)x^(m+m)f*(P(x)·Q(x))=a₀b₀+(a₀+b₁+a₁b₀)(x+c)+        -   +(a₀b₂+a₁b₁+a₂b₀)(x+c)²+. . .            -   . . . +a_(m)b_(m)(x+c)^(m+m)                Then,    -   f*(P(x))·f*(Q(x))=a₀b₀+(a₀b₁+a₁b₀)(x+c)+        -   +(a₀b₂+a₁b₁+a₂b₀)(x+c)²+. . .            -   . . . +a_(m)b_(m)(x+c)^(m+m)

Which coincides with f*(P(x)·Q(x))

Accordingly, f*(ā_((k))· b _((m)))=f*(ā_((k)))·f*( b _((m)))

Also, note that f transforms 0 into 0, and 1 into 1.

Consequently, based on the definition, transformation, f createshomomorphism of the rings f* from f. In other words

-   -   f*(a+A[x]b)=f*(a)+A[x]f*(b)

Consider a transformation g(x)=c·x.

It is necessary to prove that g* transformed from g is also homomorphismof the rings.

A sum is:

-   -   g*(R(x))=a₀+b₀+(a₁+b₁)cx+. . . . . . +(a_(m)+b_(m))(cx)^(m) .        -   g* (P(x))+g(Q(x))= a₀+a₁(cx)+. . . +a_(m)(cx)^(m)+            +b₀+b₁(cx)+. . . +b_(m)(cx)^(m)

Accordingly, g*(ā_((k))+ b _((m)))=g*(ā_((k)))+g*( b _((m)))

The product is:

-   -   g*(P(x)·Q(x))=a₀b₀+(a₀b₁+a₁b₀)(cx)+ +(a₀b₂+a₁b₁+a₂b₀)(cx)²+. . .        +a_(m)b_(m)        Then    -   g*(P(x))·g(Q(x))=a₀b₀+(a₀b₁+a₁b₀)(cx)+ +(a₀b₂+a₁b₁+a₂b₀)(cx)²+.        . . +a_(m)b_(m)(cx)^(m+m)

Which corresponds to g*(P(x)·Q(x))

Accordingly, g*(ā_((k)) b _(m))=g*(ā_((k)))g*( b _(m))

Thus, transformation of g transforms 0 into 0, and 1 into 1.

Therefore, transformation g creates homomorphism of the rings g*g*(a+A[x]b)=g*(a)+A[x] g*(b).

Any polynomial P(x)=a₀+a₁x+a₂x²+. . . +a_(m)x^(m) creates a homomorphismP* rings of a formal polynomial. Thus:

-   -   P*: A[x]→ A[x]    -   1. P*(a+A[x]b)=P*(a)+A[x]P*(b)    -   2. P*(a·A[x]b)=P*(a)·A[x]P*(b)    -   3. P*(0_(A[x])=)0_(A[x])    -   4. P*(1_(A[x])=)1_(A[x])

Homomorphic encryption in case Z₂[x].

Let the ring have only two elements 0 and 1.

Two elements need to be encrypted based on the above algorithm forperforming operations on them. An element z₁ has a formal polynomial(z₁, a_(a), a₂, . . . , a_(m)). Application of homomorphism P results ina formal polynomial (q₀, q₁, q₂, . . . , q_(m+p))

Encryption of z₂ results in (r₀, r₁, r₂ , r_(m+p)).

Accordingly, after the operations are performed, a formal polynomial isproduced. This polynomial, once decrypted, gives the result in a firstposition. If operations are performed on polynomials (both polynomialsare the results of encryption of z₁ and z₂ ) in the formz₁+f₁(z₁)+f₂(z₁) and z₂+g₁(z₂)+g₂ (z2), then a multiplication andaddition will result in something like(z₁*z₂+z₁)+(f₁(z₁)*g₁(z₂)+f₁(z₁))+. . .

The first element in the brackets can be used as the result of theoperation, if the “tail” is deleted from data that is not significant,from the perspective of the task that is being performed. This exampleshows that functionality, in the proposed method, is achieved by makingthe computations more complex and by increasing the amount ofcomputation necessary, even for simple arithmetic operations.Multiplication and addition can be viewed as operations on matrices, andthe size of the matrix becomes apparent during decryption, which isneeded to identify the meaningful portion of the element.

For example, in case of the operation q _(m+p)+ q _(m+p)· r _(m+p),after decryption, the first position in the resulting formal polynomialwill have z₁+z₁·z₂.

For example, to find value m₁+m₂ bits of polynomials (m_(1,)a,b) ,(m_(2,)c,d) are compared. Homomorphism created by the polynomialP(x)=p+q·x is applied. The resulting polynomials are:

-   -   (m₁+ap+bp²,aq+2bpq,bq²)    -   (m₂+cp+dp²cq+2dpq,dq²)

Adding them results in:

-   -   R=(m₁+m₂+ap+cp+bp²+dp², aq+cq+2bpq+2dpq,bq²+dq²)

In order to decrypt, the polynomial

-   -   R(x)+m₁+m₂+ap+cp+bp²+dp²+ +(aq+cq+2bpq+2dpq)x+(bq²+dq²)x²        is divided by p+qx, which gives the remainder m₁+m₂, as a        result.

In case of multiplication, the brackets are not open and the formalpolynomial looks like:

-   -   m₁+a(p+qx)+b(p+xq)²    -   m₂+c(p+qx)+d(p+xq)²

Multiplication of the encrypted polynomials results in:

-   -   m₁m₂+(m₁c+m₂a)(p+qx)+    -   +(m₁d+ac+m₂b)(p+qx)²+ +(ad+bc)(p+qx)³+bd(p+qx)⁴

Note that if the brackets are open, it will not be possible to recreateanything without knowing p+qx.

However, if the resulting polynomial divided by p+qx the needed bit isproduced.

An analytical approach can be described as follows. Consider a class offunctions over set M with values located on the ring A.

These functions create a ring F=A(M) relative to discrete addition andmultiplication operations. Let G=A(S), where S is a mathematical set.Consider transformation φ:M→S. This transformation can be called avariable substitution—x=φ(y), xεS, yεM . Such a substitution ofvariables creates homomorphism φ* of the rings of functions: φ*:F→G.

This can be proven as follows. Let f(x), g(x) be functions of ring F andφ*(f(x)), φ*(g(x)) be functions of ring G.

-   -   f(x)+g(x)→φ*(f(x)+g(x))=        -   1. =f(φ(x))+g(φ(x))=        -   =φ*(f(x))+φ*(g(x))    -   f(x)·g(x)→φ*(f(x)·g(x))=        -   2. =f(φ(x))·g(φ(x))=        -   φ*(f(x))·*(g(x))        -   3. 1_(F)→1_(G)        -   4. 0_(F)→0_(G)

Thus, φ* is really a homomorphism of the rings of the functions.

One example can use polynomials of rings of real numbers, integers, orprime numbers.

R[x]—a ring of polynomials.

Any polynomial P(x) creates homomorphism P*: R[x]→R[x].

In a client-server model, this can be implemented as follows. A clientwants to perform calculations on the server in such a way that theserver cannot know what data is involved in the calculations. Forexample, a client wants to calculate a value of a polynomial functionf(x₁, x₂, . . . x_(n)) at a point (a₁, a₂, . . . a_(n)). The followingsteps are executed:

-   -   a secret key x₀ is randomly picked on the client site, x₀ is a        real number;    -   for each number a_(i) from a vector of values selected b_(i),        c_(i), such that b_(i)x₀+c_(i)=a_(i);    -   linear polynomials are sent to the server in a form of        b_(i)x+c_(i) along with a polynomial function f(x₁, . . .        x_(n));    -   the client requests the server to substitute x_(i) with linear        polynomials. The server substitutes the polynomials into the        function f :    -   f(b₁x+c₁, . . . , b_(n)x+c_(n)).

Then, the server opens the brackets and sends the result to the client.Thus, the client receives the coefficients of the polynomial thatassumes the desired value at a point x_(0.)

The client substitutes x₀ into the resulting polynomial function, andfinds the desired value. Note that the server does not know the datavalue, for which the client wants to calculate the values of thefunction.

This scheme of homomorphic encryption allows to protect operations andto sort the encrypted data. Since the operations are performed with realnumbers, the point x₀ has an area where lines corresponding toa_(i)x+b_(i) do not intersect. Then a correct order is kept at point x₀,but it remains unchanged in the area.

The use of real numbers permits taking advantage of orthogonality of thetransformations, in other words, different initial data will always givedifferent encryption results. Also, for any pair of encrypted textsstrings, it is possible to identify a point x₀, such that in itsneighborhood, linear functions derived from decryption results maintaintheir relative values (smaller-larger) comparison, both before and afterencryption and decryption. For each pair, there is a particular pointx₀, that can be identified without decryption. The use of these pointsx₀ permits sorting of the list, where the list does not have identicalelements.

Accordingly, an element can be given to the server without disclosingthe encryption key.

The following schemes for fully homomorphic encryption are used in theexemplary embodiment.

Domingo-Ferre scheme.

Two prime numbers are selected—p and q, n=pq . A positive integer d isalso selected. Then (d,n) is an open key. Then, from Z_(p) and Z_(q) ,elements r_(p) and r_(q) are used, that create large multipliablesub-groups in Z _(p) and Z_(q) , respectively. Then (p, q, r_(p), r_(q))is a secret key.

The encryption is implemented as follows.

In order to encrypt element aεZ_(n), it has to be separated into a sum

${\sum\limits_{i = 0}^{d}\;{a_{i}{mod}\; n}},{a_{i} \in {Z_{n}.}}$

Then the encryption cipher looks like:

-   -   E(x)=[a₁r_(p)modp, a₁r_(q)modq], . . . . . . , [a_(d)r_(p)        ^(d)modp,a_(d)r_(q) ^(d)modq]

Decryption is performed using the Chinese remainder theorem.

Alternatively, the scheme can be implemented as follows. In order toencrypt an element aεZ_(n) a polynomial f(x) with coefficient from Z_(n)is selected such that f(x)=a₀+a₁x+. . . +a_(d)x^(d), while f(1)=a.

In other words, a=a₀+a₁x+. . . +a_(n)is an analog of

${\sum\limits_{i = 0}^{d}\;{a_{i}{mod}\; n}},{a_{i} \in {Z_{n}.}}$Let r_(p), r_(q) be the same as in the standard implementation (above).

Then, encryption is the application of homomorphisms φ_(p)=r_(p)y andφ_(q)=r_(q)y over polynomial f(x). The cipher is comprised of a pair ofcoefficients of the polynomials f_(p)(y)=f(φ_(p)(x)),f_(q)(y)=f(φ_(q)(x)) based on modulus of p and q, respectively.

Another encryption scheme that can be used in the exemplary embodimentis the Craig-Gentry scheme. Craig Gentry's fully homomorphic encryptionuses ideal lattices. Calculations are performed over a field Z₂. The twoelements can be considered as bits. Let m be a certain bit having acorresponding number that is selected as follows. Three numbers r, k, qare selected, while r<<k , k is a secret key.

Calculate c=2r+m+(2k+1)q . Note that:

-   -   cmod2=(m+q)mod2 (1)    -   cmod2k+1)mod2=m (2)

This means that knowledge of c does not define bit m (1), however if kis known, the bit m can be definitively restored (2).

Then, the bit operations according to this scheme will look as follows:

-   -   Let m₁, m₂ to be bits. Then:        -   c₁=2r₁+m₁+(2k+1)q₁        -   c₂=2r₂+m₂+(2k+1)q₂        -   c₁+c₂=2r₁+m₁+(2k+1)q₁+2r₂+m₂+            -   +(2k+1)q₂=2(r₁+r₂)+m₁+m₂+                -   +(2k+1)(q₁+q₂)                    If 2(r₁+r₂)+m₁+m₂<(2k+1), then:    -   ((c₁+c₂)mod(2k+1))mod2=(m₁+m₂)mod2

Product calculation is analogous:

-   -   c₁c₂=        -   (2r₁+m₁+(2k +1)q₁)(2r₂+m₂+(2k+1)q₂₎        -   2(2r₁r₂ +r₁m₂+r₂m₁)+m₁m₂+(2k+1)q,            where    -   q=2r₁q₂+m₁q₁+2r₂q₁+m₂q₁+q₁q₂(2k+1)

The above approach can be interpreted as follows:

Let m₁, m₂ be two bits that need to be involved in an operation. Afterthe encryption it is impossible to determine what these bits are. Therecan be four coded possible pairs: (0,0), (0,1), (1,0), (1,1). Placed ina certain order the pairs look like:

-   -   m₁: 0 0 1 1    -   m₂: 0 0 1 1        -   0 1 2 3

The bottom line is a number of a possible state, one of four. Such atable contains all possible states of bit pairs. If f(m_(1,)m₂) needs tobe calculated, the function f is a two-variable function. The function ffor all possible m₁, m₂ has no more than four different values. In orderto break the encryption, the position in the table has to be guessed. Inother words, the position within the table is a secret key.

Another embodiment takes into consideration classes of polynomialfunctions. For example, a plurality of polynomial functions with twovariables over a field Z₂ . All of these functions look likea₀1+a₁x+a₂y+a₃xy. A plurality of functions makes a ring where the degreedoes not increase after multiplication, because of relationship:

-   -   x²=x, y²=y.

In this case, homomorphisms are created by affinity mapping only.

Let m₁, m₂ be a pair of bits having corresponding polynomials:

-   -   m₁+a₁x+a₂y+a₃xy    -   m₂+b₁x+b₂y+b₃xy

Homomorphism by affinity mapping is:

-   -   x=u+v    -   y=v+1

Then, the polynomials are transformed into new polynomials:

-   -   m₁+a₁(u+v)+a₂(v+1)+a₃(u+v)(v+1)=m₁+a₂+(a₁+a₃)u+(a₂+a₃)v+a₃vv=    -   m₁+a₂+(a₁+a₃)u+(a₂+a₃)v+a₃v=m₁+a₂+(a₁+a₃)u+a₂v

Second bit is analogous:

-   -   m₂+b₂+(b₁+b₃)u+b₂v

Then, these polynomials are sent for secret calculations.

If a product of mm₁m₂ needs to be calculated, the following computationis performed:

-   -   [m₁+a₂+(a₁+a₃)u+a₂v][m₂+b₂+(b₁+b₃)u+b₂v]= (m₁+a₂)(m₂+b₂)+. . .

The polynomial of the same degree is returned to the client. The clientperforms a reverse transformation:

-   -   u=x+y+1    -   v=y+1        and uses a coefficient of a free member that equals m₁m₂.

According to another embodiment, degrees remain the same. A field Z_(p)(p is a prime number).

A ring Z_(p)[x]/R(x) , where R(x) is a polynomial of a degree d with areverse coefficient (at higher degree). Then, Z_(p)[x]/R(x) is a ring ofpolynomials to the power of d−1. Rings like Z_(p)[x]/R(x) are created inerror corrections codes. Secret computations for elements of the ringZ_(p)[x]/R(x) will result in polynomials with the same degree (it doesnot get higher).

If two polynomials f(x), g(x)εZ_(p)[x]/R(x) need to be multiplied, thena secret polynomial x=u(y) is selected and polynomials f(u(y)), g(u(y))and R(u(y)) are created. All three polynomials are sent to the serverand a product f(u(y))xg(u(y)) is calculated within a ringZ_(p)[y]/R(u(y)). The returned result is restored as described above.

The above described embodiments can be used with coefficients of anyfinite field. In other words, Z_(p) can be any finite field.

According to another embodiment, multiplication can be performed inGalois fields

For example the operation G(2⁷)=G(128) needs to be made secret.

Let m₁, m₂ εG(2⁷)

A set of polynomials with two variables is G(2⁷)[x, y]/(x²−x, y²−y) .

These polynomials look like a₀1+a₁x+a₂y+a₃xy , a₀, a₁, a₂, a₃εG(2⁷).

Then, multiplication is:(a ₀1+a ₁x+a ₂ y+a ₃ xy)(b ₀1+b ₁x+b ₂ y+b ₃ xy)=a ₀ b ₀1+(a ₀ b ₁+a ₁ b₀+a ₁ b ₁)x+(a ₀ b ₂+a ₂ b ₀+a ₂ b ₂)y+(a ₀ b ₃+a ₃ b ₀+a ₃ b ₁+a ₁ b₂+a ₂ b ₁+a ₃ b ₃+a ₂ b ₃+a ₁ b ₃+a ₃ b ₂)xy  (1)where a_(i)b_(j) is a product in G(2⁷).

A pair of corresponding polynomials

-   -   m₁+a₁x+a₂y+a₃xy    -   m₂+b₁x+b₂y+b₃xy        are found for a pair of elements m₁, m₂εG(2⁷)

Then, a substitution of variables is performed

-   -   x=u+v    -   y=v+1

This results in

-   -   m₁+a₂+(a₁)u+a₂v    -   m₂+b₂+(b₁+b₃)u+b₂v

Then, the data can be sent to a server for calculations (for example,compute a product m₁m₂), according to multiplication rules in G(2⁷) .

The result is returned and reverse substitution is preformed.Alternatively, a point with coordinates (x₀, y₀) is selected as a secretkey.

The polynomial coefficients are selected as follows:

-   -   b₀1+b₁x+b₂y+b₃xy    -   a₀1+a₁x+a₂y+a₃xy

Then

-   -   m₁=a₀1+a₁x₀+a₂y₀+a₃x₀y₀    -   m₂=b₀1+b₁x₀+b₂y₀+b₃x₀y₀

The resulting polynomials are sent to a server for computation. When theresult is returned, the secret point (i.e., key) is substituted into thepolynomial for revealing the calculated value. Note that for theprevious calculation, the secret point is (0, 1) .

In another embodiment, the coefficients are taken from G(2⁷) . Thesolution in this case is purely algebraic, since the value at a secretpoint is not relevant.

Note that for all operations with Galois fields and with polynomials,different techniques can be used. One example is described in ShayGueron and Michael E. Kounavis, Intel® Carry-Less MultiplicationInstruction and its Usage for Computing the GCM Mode, incorporatedherein by reference.

According to the exemplary embodiment, the homomorphic encryption isused for secure cloud computing. The mathematical models are describedabove. The application can be implemented in Java, but not limited tothis computer language. The application uses a proprietary library thatperforms calculations (e.g., additions, subtractions, multiplication,division, square root, root of an n^(th) power, exponentiation, etc.) onpolynomials and rational functions. According to the exemplaryembodiment, the library is adapted for confidential (i.e., secure)calculations.

According to the exemplary embodiment, the client performs the followinglogic. The client application is a browser applet that has an input boxand buttons corresponding to numbers and operations. The client inputsinto the box a mathematical expression containing real numbers,brackets, operation symbols and functions. The expression from the boxis interpreted into a function f(x₁, x₂, . . . , x_(n)) at a point (a₁,a₂, . . . , a_(n)), where a₁, , a₂, . . . , a_(n) are real number fromthe expression.

Then, syntax analysis of the client expression from the input box isperformed. For each real number a unique variable (a₁, a₂, . . . ,a_(n)) is assigned. The function is presented in a string form. When theuse presses the “=” button, the real numbers (a₁, a₂, . . . , a_(n)) arecoded by a set of polynomials. Then, a request, containing the codednumbers and function values for these numbers, is sent to the server.

The polynomials for real numbers are generated as follows:

-   -   randomly selected real number x₀ is a secret key;    -   randomly selected b_(i), ∀i=1, . . . , n;    -   ∀i selected c_(i), such that b_(i), x₀+c_(i)=a_(i).

After the appropriate operations are performed on the server, the clientreceives a resulting polynomial with one variable. The value x₀ issubstituted into the resulting polynomial. The result is calculatedusing the Gorner scheme. Note that calculation of value of thepolynomial at the point serves as decryption. A result equal to thevalue of the expression is entered into the field of a user form.

According to the exemplary embodiment, the server side implements thefollowing logic. A multi-stream server waits for client requests. Anumber of clients served can be set using special parameters. Eachclient request is processed in a separate stream. The server receives anobject containing a set of variables coded by corresponding polynomialsand functions represented by strings.

Then syntax analysis of the expression is performed using recursivedescent method. The sub-tasks with low priority pass control to thesub-tasks of the high priority. The task priorities correspond to thepriorities of mathematical operations (i.e., 1—functions, 2—brackets,3—exponentiation (raising to a power), 4—multiplication/division,5—addition/subtraction).

In the process of calculation, the function and the variables aresubstituted by the corresponding polynomials. The result, representingthe one variable polynomial, is provided to the client. In case ofexponentiation, the exponent expression is calculated first and sent tothe client. The client finds the numerical value of the exponent,re-encodes the expression and sends a set of the polynomials to theserver.

Note that homomorphic encryption can be used for encryption of serialnumbers of components and applications. For example, a developer of theapplication acts as a client. Then, an encrypted key is provided forchecking the serial number of the application to a special componentthat acts as a server. An application, once installed at the end usersite, receives a serial number and checks it by launching a specialalgorithm that uses an encrypted key and the provided key for analysis.Since the encrypted key is not available for the application, theoperations with this key for checking the serial number key areperformed using homomorphic encryption. Thus, the intruder cannotrecreate the key using the debugger or other reverse engineering means.Therefore, the intruder is not able to create a key generator (keygen).

The serial number can be verified as follows. First, without usingregistered party information, the serial number can be an already coded(by the client value) that is used by the algorithm on the server. Suchan algorithm can use key order number with checksum. The aggregate valueof the key and the check sum has to be long enough (4, 6 or 8 bytes) towithstand a brute force attack.

Subsequently, this value is encrypted by the homomorphic key and ispassed to the server. The server checks the integrity of the checksum.Note this value is decrypted on the server and validity of the serialnumber is confirmed. In order to intrude, the homomorphic encryptionprocedure has to be broken, which is virtually impossible. Note that theresult does not depend on where it is calculated, as the result uses theprovided serial number and invisible (internal) instruction for checksumverification.

First implementation is used if some unique application data is involved(for example, registration number, hardware ID, user email, user name,etc.). This unique data is given in plaintext to a component that actsas a server. In this case the above described method for mixing theplaintext data into server calculations can be used. Alternatively, thisdata (i.e., an ID of hardware components, check sums, user names, etc.)can be sent to a registration server and mixed it there with the uniqueversion serial number that contains not only some number, but aderivative from user data. Then, the above described procedure isexecuted.

Note that homomorphic transformation is used only for those parts of thecalculations where mathematical operations need to be performed. Forexample, a database entry can contain two numerical and three stringfields. To decrypt the numerical fields, for subsequent use and ranking,homomorphic transformation is used. String fields can be encrypted withany key, including a key that gives different results for the samecontents.

The result of the transformation can also be encrypted prior totransmittal from server to client, and can also satisfy requirements ofhomomorphic transformation. In other words, initial data vectors,functions and their superposition, in the preferred case, should alsosatisfy homomorphism.

A simple example of data mixing: an ordered list is created from severalencrypted entries. Each entry is given an encrypted order number—whichis a result of operations on the server.

The exemplary embodiment can also be implemented as operations on GaloisField (GF). Calculations on GF(128)—multiplication and addition can beused in the proposed method for manipulations with the polynomials usedfor fully homomorphic calculations.

According to the exemplary embodiment, a finite set of initial numericalelements is used. A finite set of operations is applied to the numericalelement so that result of the operation on any set of the elementsbelongs to the finite set of the initial numerical elements. Note thatstandard addition or multiplication does not work, because theseoperations produce the results that do not belong to the finite set ofthe initial numerical elements. Therefore, the Galois field elements areused as the initial elements and the operation of multiplication andaddition are performed according to the rules of the Galois field.

According to the exemplary embodiment, the finite set of the initialelements is transformed (encrypted) into a set of encrypted elements soeach of the encrypted elements has only one corresponding initialelement. A result of an operation on any pair of the encrypted elementsproduces a resulting encrypted element belonging to the set of theencrypted elements. According to one exemplary embodiment, the Galoisfield addition operation performs addition and/or multiplication and/orreduction of power of a polynomial.

In other words, in a homomorphic encryption scheme, each operation onthe encrypted elements has only one corresponding operation on theinitial (unencrypted) elements, which produces a resulting initialelement corresponding to the resulting encrypted element. According tothe exemplary embodiment, a set of initial elements is formed on a userside. Then, the set of the initial elements is transformed into a set ofthe encrypted elements.

Then, operations on the encrypted elements are performed and theresulting encrypted elements are produced. Subsequently, the elementsfrom the initial set corresponding to the resulting encrypted elementsare selected. According to one exemplary embodiment, the initialelements are transformed into the encrypted elements by a firstencryption algorithm (using first encryption key). Subsequently, areverse transformation uses a first decryption algorithm (using a firstdecryption key). Then, any N-th operation on two encrypted elementsproduces a result which can be transformed into the initial element byN-th decryption algorithm using the first decryption key.

Alternatively, N-th decryption algorithm requires an additionaldecryption key different from the first key. According to one exemplaryembodiment, the homomorphic encryption scheme uses an encryptionpolynomial h(x)=ξ+(x−λ)*r(x), where r(x) is an arbitrary polynomial fromthe Galois field G(2^(n))[x]. Note that the polynomial matrix has a zerodenominator and a small range d/2, if the degree of the encryptingpolynomial is d. The range does not change depending on an arbitrarydegree of the polynomial. In homomorphic encryption, multiplication ofthe polynomials does not increase degree of the encryption polynomial byusing the polynomials of the Galois ring.

In one embodiment, the Galois field elements can be used in a form ofprime numbers or in a form of vectors in one-dimensional coordinatesystem. Note that addition or multiplication of the vectors is performedby modulo value (i.e., without considering the direction), which keepsthe result within a given Galois ring.

If the polynomial operations require many multiplications or equivalentoperations, then the degree of the resulting polynomials increasesdramatically, which makes it difficult to use this concept forpublic/private key generation on the server side. To avoid this, apolynomial c(x) of degree d+1 is constructed, such that at a secretpoint z₀, c(z)=0. The polynomial c(x) becomes an open key and is sent tothe server. In this case, any multiplication of the polynomials on theserver is done using modulo c(x), therefore, there is no increase in thedegree of the polynomials. To generate such a polynomial, it issufficient to take any polynomial w(x) of degree d, thenc(x)=w(x)(x−z₀).

More generally, to reduce the increase in the degree of the polynomialduring encrypted multiplication, the following is proposed. Select apolynomial s(x)εGF(2^(n))[x]. The polynomial can presumably be factoredinto a large number of simple factors. The simplest case is linearfactors:

-   -   s(x)=(x−λ₁)(x−λ₂) . . . (x−λ_(p))r(x) , where r(x) is an        arbitrary polynomial. The elements λ₁, λ₂, . . . λ_(p)εGF(2^(n))        are randomly selected. It follows that s(λ_(i))=0, i=1, 2, . . .        , p.

Consider the ring GF(2^(n))[x]/s(x). Select a secret element λ₀ from theset λ₀ε{λ₁, λ₂, . . . λ_(p)}. For any pair, ξ₁, ξ₂εGF(2_(n)) select twopolynomials h₁(x), h₂(x)εGF(2_(n))[x]/s(x) such that h₁(λ₀)=ξ₁,h₂(ε₀)=ξ₂. Multiplication of the polynomials is done in the ring GF(2^(n))[x]/s(x) , therefore, the product does not have a higher degree.The product looks as follows:

-   -   h₁(x)h₂(x)=u(x)s(x)+v(x),

Therefore, in the ring GF(2^(n))[x]/s(x), h₁(x)h₂(x)=v(x) . On the otherhand, at the point λ₀, we get h₁(λ₀)h₂(λ₀)=u(λ₀)s(λ₀)+v(λ₀)=v(λ₀) sinces(λ₀)=0 .

Thus, ξ₁ξ₂=h₁(λ₀)₂(λ₀)=v(λ₀). The degree of the polynomial v(x) is nohigher than the degree of the polynomials h₁(x),h₂(x) .

The polynomial s(x) needs to be sent to the server, together with thedata itself.

To reduce n, the previous construction can be modified. Consider againthe ring GF(2^(n))[z], where a unitary polynomial w(z) is selected.Consider a subset R(z) of polynomials from the ring GF(2 ^(n))[z], suchthat f(z) ε R(z) if and only if f(z)=αmod(w(z)), where α is an arbitrayelement from GF(2 ^(n)). The set of R(z) is a ring, and any element f(z)ε R(z) can be represented by f(z) =g(z)w(z)+α. Note that the previousconstruction corresponds to the case where w(z)=z-θ.

Consider a given set of elements λ₁, λ₂, λ₃, . . . λ_(p)GF(2^(n)), onwhich encrypted operations need to be performed. A set of polynomialsf_(i)(z)=g_(i)(z)w(z)+λ_(i), i=1, 2, . . . , p are used to encrypt theelements. The polynomials are sent to the server. Since R(z) is a ring,the calculations will be performed correctly, and the encryption ishomomorphic.

This construction, however, has a problem with an increase in the degreeof the polynomials. To avoid this, select a unitary polynomial u(z),which has the same degree as w(z). The polynomial s(z)=u(z)w(z) can beconstructed. Then, all calculations are performed in the ring GF(2^(n))[z]/s(z). To show that the calculations are correct, considermultiplication of two elements of the Galois field, λ₁, λ_(2.) Thecorresponding encrypting polynomials are f₁(z)=g₁(z)w(z)+λ₁,f₂(z)=g₂(z)w(z)+λ₂. The product of these polynomials in the ring GF(2^(n))[z]/s(z) has the form h(z)=f₁(z)f₂(z)mod(s(z)). Using the Chineseremainder theorem, to calculate f₁(z)f₂(z)mod(s(z)) it is sufficient tocalculate F₁(z)f₂(z)mod(u(z)), f₁(z)f₂(z)mod(w(z)). Since u(z), w(z)have the same degree, the calculation is correct. On the other hand,f₁(z)f₂(z)mod(w(z))=(g₁(z)w(z)+λ₁)(g₂(z)w(z)+λ₂)mod(w(z))=γ₁ XOR γ₂.From this, it follows that h(z)mod(w(z))=γ₁ XOR γ₂. Thus, if the serverreturns h(z), then the product can be recovered from it, withoutcalculating roots.

The approach described herein is applicable to many scenarios where theserver or cloud service has to perform calculations on data withoutknowing what the data itself is. For example, operations with databasescan be performed in this manner. Operations with bank accountverifications can also be performed in this manner. A user has anaccount at bank A and an account at bank B. Both banks provide thebalances (in encrypted form) to the cloud service, which then adds themhomomorphically, and provides the result to a third party. Thus, thethird party will know the total balance in the accounts A and B—but notthe balance in each individual account.

One of the advantages of some of the embodiments described herein isthat calculations on Galois fields GF(2^(n)) may be easily performed onhardware level. E.g., the sum of Galois field elements is performed viaXOR operation, which is a single hardware step hardware on mostprocessors. Also, calculations on Galois fields never result in invaliddata, “buffer overflows” or errors of that nature. Also, the proposedapproach protects from brute force code hacking.

With reference to FIG. 1, an exemplary system for implementing theinvention includes a general purpose computing device in the form of apersonal computer or server 20 or the like, including a processing unit21, a system memory 22, and a system bus 23 that couples various systemcomponents including the system memory to the processing unit 21. Thesystem bus 23 may be any of several types of bus structures including amemory bus or memory controller, a peripheral bus, and a local bus usingany variety of bus architectures. The system memory includes read-onlymemory (ROM) 24 and random access memory (RAM) 25. A basic input/outputsystem 26 (BIOS), containing the basic routines that help to transferinformation between elements within the personal computer 20, such asduring start-up, is stored in ROM 24.

The personal computer 20 may further include a hard disk drive 27 forreading from and writing to a hard disk, not shown in the figure, amagnetic disk drive 28 for reading from or writing to a removablemagnetic disk 29, and an optical disk drive 30 for reading from orwriting to a removable optical disk 31 such as a CD-ROM, DVD-ROM orother optical media. The hard disk drive 27, magnetic disk drive 28, andoptical disk drive 30 are connected to the system bus 23 by a hard diskdrive interface 32, a magnetic disk drive interface 33, and an opticaldrive interface 34, respectively.

The drives and their associated computer-readable media provide anon-volatile storage of computer readable instructions, data structures,program modules/subroutines, such that may be used to implement thesteps of the method described herein, and other data for the personalcomputer 20.

Although the exemplary environment described herein employs a hard disk,a removable magnetic disk 29 and a removable optical disk 31, it shouldbe appreciated by those skilled in the art that other types of computerreadable media that can store data accessible by a computer, such asmagnetic cassettes, flash memory cards, digital video disks, Bernoullicartridges, random access memories (RAMs), read-only memories (ROMs) andthe like may also be used in the exemplary operating environment.

A number of program modules may be stored on the hard disk, magneticdisk 29, optical disk 31, ROM 24 or RAM 25, including an operatingsystem 35 (e.g., WindowsTM 2000). The computer 20 includes a file system36 associated with or included within the operating system 35, such asthe Windows NT® File System (NTFS), one or more application programs 37,other program modules 38 and program data 39. A user may enter commandsand information into the personal computer 20 through input devices suchas a keyboard 40 and pointing device 42.

Other input devices (not shown) may include a microphone, joystick, gamepad, satellite dish, scanner or the like. These and other input devicesare often connected to the processing unit 21 through a serial portinterface 46 that is coupled to the system bus, but may be connected byother interfaces, such as a parallel port, game port or universal serialbus (USB). A monitor 47 or other type of display device is alsoconnected to the system bus 23 via an interface, such as a video adapter48. In addition to the monitor 47, personal computers typically includeother peripheral output devices, such as speakers and printers.

The personal computer 20 may operate in a networked environment usinglogical connections to one or more remote computers 49. The remotecomputer (or computers) 49 may be represented by a personal computer, aserver, a router, a network PC, a peer device or other common networknode, and it normally includes many or all of the elements describedabove relative to the personal computer 20, although only a memorystorage device 50 is illustrated. The logical connections include alocal area network (LAN) 51 and a wide area network (WAN) 52. Suchnetworking environments are commonplace in offices, enterprise-widecomputer networks, Intranets and the Internet.

When used in a LAN networking environment, the personal computer 20 isconnected to the local network 51 through a network interface or adapter53. When used in a WAN networking environment, the personal computer 20typically includes a modem 54 or other means for establishingcommunications over the wide area network 52, such as the Internet. Themodem 54, which may be internal or external, is connected to the systembus 23 via the serial port interface 46.

In a networked environment, program modules depicted relative to thepersonal computer 20, or portions thereof, may be stored in the remotememory storage device. It will be appreciated that the networkconnections shown are exemplary and other means of establishing acommunications link between the computers may be used. Such computers asdescribed above can be used in conventional networks, e.g. the Internet,local area networks, regional networks, wide area networks, and soforth. These networks can link various resources, such as usercomputers, servers, Internet service providers, telephones connected tothe network and so on.

Having thus described a preferred embodiment, it should be apparent tothose skilled in the art that certain advantages of the described methodand apparatus have been achieved. It should also be appreciated thatvarious modifications, adaptations, and alternative embodiments thereofmay be made within the scope and spirit of the present invention. Theinvention is further defined by the following claims.

What is claimed is:
 1. A system for protected cloud computing to providea cloud service, the system comprising: a server receiving encrypteddata from a client; and the cloud service implemented on the serverperforming fully homomorphic calculations for the client withoutdecryption of the encrypted data and providing a result of thecalculations to the client for decryption, wherein: a finite set ofinitial elements are generated on the client and are fullyhomomorphically encrypted into a set of n encrypted elements, such thatall calculations on unencrypted elements correspond to the samecalculations on encrypted elements, the n encrypted elements belong tothe finite set of the initial elements and each of the n encryptedelements has only one corresponding initial element, and the initialelements are encrypted using an n-bit secret key z₀ that belongs to aGalois field G(2^(n)), and for any initial element u of a Galois fieldG(2^(n)) there are n randomly generated elements a1, a2, . . . , ad ofG(2^(n)) for which a₀=u−(a₁z₀+a₂(z₀)²+. . . +a_(d)(z_(o))^(d)), and apolynomial v(z)=a₀+a₁z+a₂z²+. . . +a_(d)z^(d) from a Galois fieldG(2²)[z] corresponds to u with v(z)=u, with the coefficients a_(d) usedas a public encryption key, and wherein the encryption uses anencryption polynomial h(z)=u+(z−z₀)*r(z) where r(z) is an arbitrarypolynomial from the Galois field G(2^(n))[z], and z₀ and u are fixedelements of the Galois field G(2^(n))[z].
 2. The system of claim 1,wherein Galois field elements are used as the initial elements.
 3. Thesystem of claim 2, wherein the Galois field elements are prime numbers.4. The system of claim 2, wherein the Galois field elements are vectors.5. The system of claim 2, wherein the Galois field elements correspondto real numbers.
 6. The system of claim 1, wherein an operation on anypair of the encrypted elements produces an encrypted element belongingto the set of the encrypted elements.
 7. The system of claim 1, whereina result of the calculations performed on the server is encrypted andthe decryption requires the secret key z₀.
 8. The system of claim 1,wherein a reverse transformation uses a decryption algorithm and thesecret key z₀, and for any initial element u of the Galois fieldG(2^(n))[z], there are n randomly generated elements a₁, a₂, . . . ,a_(d) of the Galois field G(2^(n))[z].
 9. The system of claim 1, whereineach operation on the encrypted elements has only one correspondingoperation on the initial elements, and the operation produces aresulting initial element corresponding to the resulting encryptedelement.
 10. The system of claim 1, wherein the encrypted elements arepolynomials, and all operations, including any multiplicationoperations, are performed on the encrypted elements without increasing adegree of the polynomials.
 11. The system of claim 1, wherein theencrypted elements are polynomials, and all operations, including anymultiplication operations, are performed on the encrypted elements andresult in polynomials having a degree no higher than originalpolynomials.
 12. The system of claim 1, wherein the encrypted elementsare polynomials, and all operations, including any multiplicationoperations, are performed on the encrypted elements and result inpolynomials having a degree that is a constant known prior to theoperations.
 13. A computer-implemented method for protected cloudcomputing to provide a cloud service, the method comprising configuringat least one computing device to perform the functions of: the cloudservice implemented on a server to perform calculations for a client,wherein the server performs calculations without decryption of encrypteddata and provides a result back to the client, such that the client candecrypt the result; generating a finite set of initial elements on theclient and fully homomorphically encrypting the finite set of initialelements into a set of n encrypted data elements, such that allcalculations on unencrypted elements correspond to the same calculationson encrypted elements, transmitting the n encrypted data elements to theserver; wherein the n encrypted elements belong to the finite set of theinitial elements and each of the n encrypted elements has only onecorresponding initial element on the server receiving encrypted datafrom the client, wherein the initial elements are encrypted using ann-bit secret key z₀ that belongs to a Galois field G(2^(n)), andwherein, for any initial element u of a Galois field G(2^(n)) there aren randomly generated elements a1, a2, . . . , ad of the Galois fieldG(2^(n)) for which a₀=u−(a₁z₀+a₂(z₀)²+. . . +a_(d)(z₀)^(d)), and apolynomial v(z)=a₀+a₁z+a₂z²+. . . +a_(d)z^(d) from G(2^(n))[z]corresponds to u with v(z₀)=u, with the coefficients a1, a2, . . . , adused as a public encryption key, and wherein the encryption uses anencryption polynomial h(z)=u+(z−z₀)*r(z), where r(z) is an arbitrarypolynomial from a Galois field G(2^(n))[z], and z₀ and u are fixedelements of the Galois field G(2^(n))[z].
 14. The method of claim 13,wherein the coefficients are generated from a random number k, with2<k<n, and a secret set of elements s_(ij)εGF(p^(n)) i=1, 2, . . . , k,j=k+1, . . . , n, which are the same for the session, for both clientand server, wherein p is a prime number, and wherein the coefficientsa₁, a₂, . . . , a_(k) are selected based ona_(i)=s_(i1)a_(k+1)+s_(i2)a_(k+2)+. . . +s_(id)a_(d), i=1, 2, . . . , k,and the coefficients a_(k+1), a_(k+2), . . . , a_(n) are randomlyselected.
 15. The method of claim 14, wherein p=2.
 16. The method ofclaim 15, wherein p elements λ₁, λ₂, . . . λ_(p) of any Galois Field andthe polynomial r(x) of a degree k are used to generate a polynomial s(x)of a degree k+p, s(x) in a form of s(x)=(x−λ₁)(x−λ₂) . . .(x−λ_(p))r(x); element λ₀ is selected from the set λ₁, λ₂, . . . λ_(p)and is used as the secret key; u being the data on which serveroperations are performed using a polynomial f(x)=a₀+a₁x+a₂x²+. . .+a_(k+p−1)x^(k+p−1) of a degree k+p−1, such thatu=f(λ₀)=a₀+a₁λ₀+a₂(λ₀)²+. . . +a_(k+p−1)(λ₀)^(k+p−1,) wherein u and s(x)are transmitted to the server, all calculations are performed in thering GF(2^(n))[x]/s(x), and a degree of any resulting polynomial is nohigher than k+p−1.